Innovative Minds - On Point - One Group  

Application Security

This is the blog for MindPoint Group's Information Security & Privacy (ISP) division. We hope to use this to contribute to and debate ideas among the ISP community.
28
Mar
2019

Using CSPs to Reduce Front-End Attack Vectors

By:

What is a CSP? CSP is an acronym for Content Security Policy. It can be used as a white-list of things the browser can and can’t do with a Web App or Website. A CSP can help prevent content injection vulnerabilities like Cross Site Scripting (XSS) and can be used to mitigate interception attacks like

Read More

13
Mar
2019

XXE Vulnerability in BlackBerry AtHoc (Networked Crisis Communication) Platform

By:

Recently I had the opportunity to test an installation of AtHoc – BlackBerry’s emergency notification system. During the course of the test, I discovered an XML External Entity (XXE) vulnerability in BlackBerry AtHoc 7.6.0 affecting the Delivery Template feature used to customize emergency notification messages and demonstrated how an authenticated attacker could read files off

Read More

06
Dec
2018

REST Assured: Penetration Testing REST APIs Using Burp Suite: Part 3 – Reporting

By:

Welcome back to the REST Assured blog series for Part 3: Reporting. While often overlooked by security professionals, compiling reports is almost always required among penetration testers post-testing. That’s why today we’re going to review how to put all of our findings together and have a thorough paper trail. Reporting Using Burp Suite, it’s relatively

Read More

18
Nov
2018

REST Assured: Penetration Testing REST APIs Using Burp Suite: Part 2 – Testing

By:

Welcome back! In part 1 of REST Assured blog series, we discussed the definitions and history behind APIs, and we reviewed the proper configuring of Burp Suite for conducting security testing against them. In Part 2 of the blog, we’re going to be getting into the fun part: Testing. Testing I’ll preface the testing first

Read More

14
Nov
2018

REST Assured: Penetration Testing REST APIs Using Burp Suite: Part 1 – Introduction & Configuration

By:

Introduction: Hello and welcome to our 3-part blog series where we will take a dive into the technical aspects of conducting exhaustive penetration tests against REST API services and generating reports based on what tests were performed and what our findings are. Due to the subject matter being relatively technical, I’m taking some assumptions in

Read More